98be1baa2d5b0db636f173637d0e1a140cb45bd249fe50cc794be53a5bbda29a

General

Target

611ce4df35ec5ff400f1a50b7b1de533.html
Size

29KB
MD5

611ce4df35ec5ff400f1a50b7b1de533
SHA1

64cf371d33b6252b5db0b96e4102778af2833dfa
SHA256

98be1baa2d5b0db636f173637d0e1a140cb45bd249fe50cc794be53a5bbda29a
SHA512

fba0048d34d3d6721b21d8fa04af9504bd5e88d94ecf8a5540a2274c9373be1376a8a865117431121337a2b92eef9a9e83e0eb27501f4bb04c947ff460aceb28
SSDEEP

192:aoZwwPf1tsziprq1e1/CbnYCP9UZAf2UcAVU7AnUod2zj6EuimCItt40fZ9c+uZ3:bYipXGRqc5uFFshS4A22UG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B91F1051-AC61-11EE-9479-523091137F1B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	iexplore.exe
1044	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 760	1044	iexplore.exe	17
PID 1044 wrote to memory of 760	1044	iexplore.exe	17
PID 1044 wrote to memory of 760	1044	iexplore.exe	17
PID 1044 wrote to memory of 760	1044	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\611ce4df35ec5ff400f1a50b7b1de533.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2
  2⤵
  PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f2954b2910f9f43be70d8d5711edaeac

SHA1
c8e3ed29b2a37d26dde1bd4cf818a1efc4d5eda0

SHA256
e27158afe77c600120745085fb7f6154a952dac00cf08e9de7b5ea4000674090

SHA512
e31367108b1219fd386a3f12c3bf1213fc34ee45df381d339578ce62bbb71add7d09d128d3424c1219f216af29f90bcc3cd9b2bfb4d0b10065a02db75439ddbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f70031ca4583c39c01afb3ed1f9c79d1

SHA1
78814275a460ec6abdac94219a8c80a120473191

SHA256
dda0bf73bf47f327cd299f8f2f6fa826fa043a3a63ca84ccbc3c71e6990f417b

SHA512
d251755b2d9cb0cccd9a671202244cde670c0771d27515435820844218283edcfd0fa7758d4293d2db47814bcdab375e036c5b0f5a4d5099c40b95e8fc2aa06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d42be94a8d36b7be49418aa88e03b50f

SHA1
fbbecaa519ef71ecd8e3122582984f6b4a8072a0

SHA256
4a307f812b2ba310ad1565c747bd757f366aca3b1da6a13069b1510b1f1d9eb8

SHA512
57114f27840f5046fe42ef3def6d13ce1194d11572474dc310d5d90c1fb6dd85b40c3110addf395d4fe1fcebbc6a76f08e2d7ad2b1b846107e60a90cb06b5ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c03a7f38ceb32c5fb55ca644c5260efe

SHA1
d04dbddb819b299eb6f65620e1126e4ffb7fb6b4

SHA256
24b7d9936abd0796480c034574938029255d6bfc37762e45c45b227fd5f98173

SHA512
1555dd1aaa1ad7ec0741bd11be910d0831b9be0f9c2ded148c42d64748408cc9262c4fe0134c9a84a8d3f989eec9c25ba0b712bc24e3518d387a7d71e5043c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b5ac7fafca5dd58245104e737e225ce

SHA1
d949148a352de62beb036fe20a5961a46f6ed75c

SHA256
e4975f6b65787d893f175c065a94723007ec327e0f2a73a0fd9c19c0a2cf02af

SHA512
84f89656916553b6172580ce8b4dffa115be13ebecb96d426eaa0c6be550700eca95620768632fe87271b00d00a6bc7b4a224f721a86fe8e2803d69a003d6b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71fe7dbb3e8c64abe8837b251ac3ed5b

SHA1
5ef40b60377441fadb8b1bd16549b35e7d2a6db5

SHA256
82ba9e04b5ab66d977081a745df56f9b062efdfc78d347832d0481f1c4a80919

SHA512
70788aef1db1b6a02539f931af5ff576fde91930e01880f6373b1735c957c7bd20687a7ec2f708a73a9eda3e8218e0feff1e753ff9bfbc9568840f4bfb90874a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f45e679be304380ea45d11da4501cf0

SHA1
981e9c89fa82531591c97cb1961d7d5af95c9662

SHA256
428120e8589d5dec81c337ad39b1ba36d7041878f3ce98c44d088fe0fe9d174e

SHA512
90fd6f6a09fab181464b7a524d7ff72a7e06e063ac082790c24e195df4cb144ac6901c4952b8a38120f87dbff8af8a91e0b96201bbf5cfb3b29a2a433b2a7ef7

Download Submit

Analysis

Sharing